CVE-2026-93433 Overview
A stack buffer overflow vulnerability exists in libstoragemgmt, a library that provides a vendor-agnostic API for managing storage arrays. The flaw resides in the _sg_parse_vpd_80() function, which parses Small Computer System Interface (SCSI) Vital Product Data (VPD) page 0x80 during serial number retrieval. An attacker with control over a local or virtual storage device can supply a crafted page length field, triggering an out-of-bounds write on the stack. Exploitation results in denial of service by crashing or destabilizing the process querying the device serial number. The weakness is classified as a Stack-based Buffer Overflow [CWE-121].
Critical Impact
A low-privileged local attacker controlling a storage device can crash processes using libstoragemgmt by returning malformed SCSI VPD page 0x80 data.
Affected Products
- libstoragemgmt library (versions prior to the fixed release)
- Red Hat Enterprise Linux distributions shipping libstoragemgmt
- Storage management applications linking against libstoragemgmt
Discovery Timeline
- 2026-09-21 - CVE-2026-93433 published to NVD
- 2026-09-22 - Last updated in NVD database
Technical Details for CVE-2026-93433
Vulnerability Analysis
The libstoragemgmt library queries SCSI devices for identifying data using standardized VPD pages. Page 0x80 carries the Unit Serial Number, structured with a header followed by a variable-length serial number field. The parser in _sg_parse_vpd_80() reads the page length field from the returned buffer and uses that untrusted value when copying serial number bytes into a fixed-size stack buffer.
Because the length is not bounded against the destination buffer size, a device returning an oversized page length causes the copy operation to write past the stack frame. Overwriting adjacent stack data corrupts control structures used by the calling process, producing a crash. Exploitation requires local access and low privileges, and impacts availability only. Confidentiality and integrity are not affected in the reported scope.
Root Cause
The root cause is missing validation of the VPD page 0x80 length field before it drives a stack copy. The parser trusts device-supplied metadata rather than clamping the length to the declared size of the destination buffer. This pattern falls under [CWE-121: Stack-based Buffer Overflow].
Attack Vector
An attacker must control a physical storage device, a virtual SCSI device (for example, exposed through a hypervisor or qemu guest), or an iSCSI target reachable by the host. When management tooling queries the serial number, the attacker returns a VPD page 0x80 response with an inflated page length. Remote exploitation is not possible without local device presence.
No public proof-of-concept code has been released for CVE-2026-93433. Refer to the Red Hat CVE-2026-93433 Advisory and Red Hat Bug Report #2465818 for vendor technical details.
Detection Methods for CVE-2026-93433
Indicators of Compromise
- Repeated crashes or SIGSEGV signals in processes linking libstoragemgmt, particularly lsmd or storage management CLIs.
- Core dumps referencing _sg_parse_vpd_80() in the crash backtrace.
- Newly attached virtual or iSCSI devices immediately followed by storage daemon instability.
Detection Strategies
- Monitor system logs and systemd-coredump output for aborts inside libstoragemgmt symbols.
- Compare installed libstoragemgmt package versions against vendor-fixed releases using package inventory tooling.
- Audit hypervisor and iSCSI target configurations for untrusted or attacker-influenced SCSI devices.
Monitoring Recommendations
- Alert on abnormal termination of storage management services and correlate with recent device attach events.
- Track SCSI VPD inquiry responses in environments where guest-controlled virtual disks are exposed to host tooling.
- Baseline expected serial number lengths and flag responses that exceed typical VPD page 0x80 sizes.
How to Mitigate CVE-2026-93433
Immediate Actions Required
- Apply vendor updates for libstoragemgmt as soon as distribution patches are published.
- Restrict which users and workloads can attach virtual storage devices to hosts running storage management daemons.
- Avoid running libstoragemgmt-based tooling against untrusted iSCSI targets or attacker-controlled devices.
Patch Information
Red Hat has issued tracking for this issue under the Red Hat CVE-2026-93433 Advisory. Consult the advisory for the specific package versions containing the fix for each supported Red Hat Enterprise Linux stream. Rebuild or update any downstream distribution packages that vendor libstoragemgmt from upstream sources.
Workarounds
- Disable or unload storage management services that call _sg_parse_vpd_80() on hosts exposed to untrusted SCSI devices until patches are applied.
- Enforce least privilege on accounts permitted to attach block devices, particularly in virtualized and container environments.
- Isolate management hosts from tenant-controlled iSCSI targets using network segmentation.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
